"Send me a quick text"

Episode Description:

This episode exposes how attackers hide inside WordPress’s must-use plugins to create a self-healing backdoor. We explain how a loader in the wp-content/mu-plugins folder fetches a remote payload hidden with ROT-13, plants a hidden file manager in the theme directory, creates a rogue admin account, installs a malicious plugin, and locks out legitimate owners.

Defensive Actions:

• Inspect wp-content/mu-plugins regularly and remove any unknown files.
• Search the WordPress database wp_options table for suspicious entries such as _hdra_core.
• Check the theme directory for unexpected PHP files (e.g., pricing-table-3.php).
• Audit all administrator accounts; delete unknown users and reset passwords.
• Keep WordPress core, themes, and plugins fully updated.
• Enable Two-Factor Authentication (2FA) on all admin accounts.
• Use file integrity monitoring tools like Wordfence, Sucuri, or server-side IDS to alert on changes in sensitive directories.

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.